mirror-mind 0.40.0-next.1 → 0.40.0

package/docs/releases/index.md

@@ -12,6 +12,7 @@ Future release notes should use the structure defined in [Release Notes](../proc
 
 ## Releases
 
+- [v0.40.0 — A Reply Stays in Its Own Conversation, and a Journey Can Go](v0.40.0.md) — minor release closing the first release train: CR151, a session's transcript fills only the conversation that session is bound to, each reply stamped with its transcript time, where it used to fill every open reply-less conversation in the transcript's window, another session's included; a transcript no session owns backfills nothing; and CR200, previewed as v0.40.0-next.1, `mirror-mind/desktop` deletes a Journey with every record that belongs to it, by digest, behind a verified backup. Update every install that has a home. No migration.
 - [v0.40.0-next.1 — A Journey Can Go, Showing What Goes With It](v0.40.0-next.1.md) — preview under npm's `next`, read by no updater, for Nautilus for Mirror (the release train): CR200, `mirror-mind/desktop` gains `previewJourneyDeletion` and `deleteJourneyWithRecords`, deleting a Journey with every record that belongs to it after a preview that counts it, by digest, behind a verified backup; child Journeys refuse. Terminal users receive it with v0.40.0. No migration.
 - [v0.39.5 — The Node You Named, or Why Not](v0.39.5.md) — patch release of CR192, from PR #47's thread (@rodrigoimmaginario): the hook wrappers, the plugin's MCP entry, and `runtime diagnose` use `MIRROR_NODE` only as an absolute path to an executable file, as the Pi extension does; a relative value is never run, and a refused one is named with its reason, once a day in `hooks.log` and on the MCP entry's stderr; the Windows installer's drive-letter path counts as absolute, in CI under Git Bash and on the installer. No migration.
 - [v0.39.4 — The Reply Finds Its Prompt](v0.39.4.md) — patch release of PR #51 (@alannascimento1), CR166 and CR196: on Claude Code, a prompt typed while a turn runs and a journey entered in plain words no longer lose the reply; `nothing_waiting` in `hooks.log` means a lost reply again. No schema change, no migration.

package/docs/releases/v0.40.0.md

@@ -0,0 +1,158 @@
+---
+digest: >
+  v0.40.0 closes the first release train. It carries CR151: a session's transcript is
+  written only into the conversation that session is bound to, each reply stamped with its
+  own transcript time, where before it was copied into every open, reply-less conversation
+  in the transcript's window, another session's included. It also carries CR200, previewed
+  as v0.40.0-next.1 for Nautilus for Mirror: a host can delete a Journey with every record
+  that belongs to it, after a preview that counts what will go, by digest, behind a
+  verified backup. A transcript no session owns, or a session bound to no conversation,
+  now backfills nothing. No schema change, no migration, and no model or prompt change.
+---
+
+# v0.40.0 — A Reply Stays in Its Own Conversation, and a Journey Can Go
+
+**Date:** 2026-11-06
+
+The first stable release under [the release train](../process/versioning.md#the-release-train):
+everything merged into `main` since v0.39.5, in one batch. One of its two changes users
+have never had; the other reached embedding hosts as a preview on the same day.
+
+## Highlights
+
+- **A session's replies go into its own conversation, and only there**
+  ([CR151](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr151-the-transcript-backfill-writes-a-session-s-replies-into-other-sessions-conversations.md)).
+  At `SessionEnd`, on Claude Code and the runtimes that share its hook, the transcript
+  filled every conversation in its time window that had no assistant message yet. An open
+  conversation that started earlier was always in the window: a session killed in its first
+  turn, or a concurrent session still in its own. Now the transcript fills the conversation
+  `runtime_sessions` binds to the ending session, inside that conversation's own window.
+- **A reply carries its own time.** The copy used to be stamped with the hook's clock, so
+  every reply sorted after every prompt of its conversation, and an extraction read all the
+  questions and then all the answers. A reply now carries its transcript timestamp,
+  normalized to the logger's microsecond form, so recall, extraction, and the MCP read
+  model read the turns in order.
+- **A transcript nobody owns writes nothing.** A payload with no `session_id`, and a session
+  bound to no conversation, used to backfill by window alone. Both are retired: with no
+  key there is no attribution. A "same runtime only" fallback was rejected because it would
+  not have fixed the recorded case, in which the orphan and the session that wrote into it
+  were both `claude_code`.
+- **A Journey and its records, deleted in one act**
+  ([CR200](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr200-delete-a-journey-with-its-records-after-showing-what-will-go.md),
+  previewed as [v0.40.0-next.1](v0.40.0-next.1.md)). `mirror-mind/desktop` gains
+  `previewJourneyDeletion` and `deleteJourneyWithRecords`: the preview counts the Journey's
+  records, and the deletion acts only on the preview the person saw, in one transaction,
+  behind a named backup verified before any write. Child Journeys refuse.
+- No schema change, no migration, and no model or prompt change.
+
+## Where We Started
+
+CV21.DS5.US3's live route on 2026-10-20 found three product defects and stopped at its own
+rule: capture, don't fix inside the story. One of them was CR151. A hand-run diagnostic had
+left an open `claude_code` conversation with one prompt and no Stop; the route's Claude
+session ended at 20:41, and its reply `ready` landed in its own conversation and in the
+orphan's, at the same instant. The port had inherited the behavior from the Python fallback
+it replaced, written when one session at a time was the only case, and no test pinned the
+scoping.
+
+The Navigator accepted the plan after a review through three lenses. The database
+architect's finding set the shape: the key already existed (`runtime_sessions.conversation_id`)
+and the backfill ignored it, so the fix is to use it, and no fallback survives that the
+evidence case would pass through.
+
+## What Changed
+
+**CR151.** `backfillAssistantMessages(db, transcriptPath, conversationId, deps)` takes the
+conversation as a required argument: one row, its own `[started_at, ended_at]` window, and
+skipped when it already logged a reply, so a Stop-logged one is not recorded twice.
+`handleSessionEndHook` reads the bound conversation before `endSession` closes the
+session, rather than relying on the close to preserve it. `normalizeTimestamp` pads
+Claude's millisecond `.123Z` to the logger's `.123000Z`, because as strings `.123Z` sorts
+after `.123456Z`. Both headers say the code departs from the Python port on purpose, so
+nobody fixes it back.
+
+The seven-conversation fixture that sat on every window boundary is kept, graded now by
+what it was always meant to show: naming one conversation changes it and leaves the other
+six exactly as they were. The golden that recorded Python filling all seven at once stays as
+a frozen record of the defect, since its generator and its Python source are gone.
+
+**Validated on a real session.** The Navigator ran the route against Claude Code 2.1.318:
+the orphan kept its prompt alone, and the session's reply carried the transcript's own
+timestamp. Two earlier runs failed, and told us something worth keeping: the Navigator's
+machine has Claude settings that pin `MIRROR_BIN` to the installed package over whatever the shell exports,
+and a second copy of the plugin loads from `~/.claude/skills`, so both runs executed the
+published 0.39.5. They reproduced the defect on a real session (`ready` in the orphan, after
+the conversation's close, with no `turn_id`), which is the "before" the CR now records.
+The route pins the checkout with `--settings`.
+
+**CR200** is as [v0.40.0-next.1](v0.40.0-next.1.md) describes it: four rules for what
+belongs to a Journey, a closed inventory a test holds against the schema, and refusals that
+write nothing.
+
+**Also in this release.** The Windows installer's real `MIRROR_NODE` path is named where
+docs and comments had named another. The tests and smokes read their paths through
+`fileURLToPath`, so a checkout under `Código` or `My Projects` no longer fails 113 tests
+(issue #44), and the guard that keeps the product from reading a URL's pathname as a path
+now covers them. The lifecycle smoke asserts the new session-less contract. Captured for
+later: CR198 (`runtime diagnose` does not name a refused `MIRROR_NODE`), CR199
+(`deliverMirrorContext` takes three to seven seconds before a Desktop turn), and CR201.
+
+## Conscious Exclusions
+
+- **Replies already copied stay where they are.** A home that ran an earlier version may
+  hold a reply under the wrong conversation. Nothing in the data tells it from a real one,
+  and removing one is a manual edit; the selector under Upgrading finds the candidates.
+- **A late `SessionEnd` still adds replies after the extraction.** When maintenance closed
+  and extracted a conversation first, the replies the backfill then adds are read by no
+  extraction. CR151 pins that they land in the right conversation, not what then reads them.
+  [CR201](../project/refinement/rs010-cv22-oracle-and-port-hygiene/cr201-a-reply-backfilled-after-the-close-misses-the-extraction-that-closed-the-conversation.md)
+  holds the decision.
+- **The session-less route is gone, not narrowed.** A caller that fed a transcript alone to
+  `conversation-logger session-end` now gets a no-op.
+- No CLI command deletes a Journey with its records; a host is the only caller. No cascade
+  through child Journeys; files on disk are the host's.
+
+## What We Learned
+
+A fallback written for one case does not know about the second. The Python backfill was
+right for a machine with one session at a time, and ordinary use of Mirror, a Ctrl-C in a
+first turn, was enough to make it wrong.
+
+The test that proves a fix is the one that runs the code you changed. Two of the Navigator's three live
+runs exercised the previous release, because a setting the validator did not know about decided
+which Mirror the hooks ran. The checkout's own `mirror-hook` was never in the path. Pinning
+the code under test is part of the route now, and the failed runs stay in the record as
+the defect, measured on a real session, in the published release.
+
+## Upgrading
+
+```bash
+mirror runtime update
+```
+
+Update every install that has a home: the fix lives in the core that the hooks run, and a
+machine whose Claude Code runs a global install keeps the old backfill until that install
+is updated. Plugin copies need no change.
+
+To find replies an earlier version copied into the wrong conversation, read-only:
+
+```bash
+sqlite3 ~/.mirror-minds/<user>/memory.db \
+  "SELECT substr(a.conversation_id,1,8) AS conv, a.created_at, substr(a.content,1,40)
+     FROM messages a JOIN messages b
+       ON a.content = b.content
+      AND substr(a.created_at,1,19) = substr(b.created_at,1,19)
+      AND a.conversation_id < b.conversation_id
+    WHERE a.role = 'assistant' AND b.role = 'assistant'
+    ORDER BY a.created_at"
+```
+
+A match is one reply written into two conversations within the same second, which is the
+trace of one backfill; read each row, because two identical short replies a second apart in
+different conversations are a different thing. The home's dated backups hold the rows as they
+were.
+
+## Next Horizon
+
+CR201's decision, how often the late path is taken on a real home; CR198 and CR199; CR195
+in RS010's backlog. The next train leaves when the Navigator calls it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mirror-mind",
-  "version": "0.40.0-next.1",
+  "version": "0.40.0",
   "description": "Mirror Mind: a local-first memory and identity framework for agentic AI runtimes (Pi, Claude Code, Codex, Antigravity)",
   "license": "MIT",
   "repository": {

package/plugins/mirror-mind/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mirror-mind",
-  "version": "0.40.0-next.1",
+  "version": "0.40.0",
   "description": "Mirror Mind — local-first memory and identity for agentic runtimes.",
   "author": {
     "name": "Mirror Mind"

package/plugins/mirror-mind/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mirror-mind",
   "description": "Mirror Mind — local-first memory and identity for agentic runtimes.",
-  "version": "0.40.0-next.1",
+  "version": "0.40.0",
   "mcpServers": {
     "mirror-mind": {
       "command": "/bin/sh",

package/ts/src/conversation/logger.ts

@@ -584,7 +584,6 @@ export interface HookLoggingOptions {
 export type SessionEndHookOutcome =
   | { action: "skipped"; reason: "malformed_payload" | "nothing_to_do" }
   | { action: "ended"; sessionId: string; transcriptPath: string | null; backfilled: boolean }
-  | { action: "backfilled"; transcriptPath: string }
   | { action: "failed"; error: string };
 
 const parsePayload = parseHookPayloadObject;
@@ -917,12 +916,15 @@ export function handleStopHook(
 }
 
 /**
- * Python `hook_session_end`: end the session when the payload names one, then
- * backfill assistant turns from the transcript when it exists -- in that
- * order, so the just-ended conversation's `ended_at` bounds the backfill.
+ * Python `hook_session_end`: end the session the payload names, then backfill
+ * assistant turns from its transcript when it exists -- in that order, so the
+ * just-ended conversation's `ended_at` bounds the backfill.
  *
- * The two halves are independent: an empty `session_id` with a transcript
- * still backfills (the session-less route, slice E), and a session without a
+ * The backfill fills only the conversation the session is bound to (CR151).
+ * Python's session-less route -- no `session_id`, a transcript alone, filling
+ * every conversation in the transcript's time window -- is gone: a transcript
+ * no session owns cannot be attributed, so it writes nothing. A session with no
+ * bound conversation likewise backfills nothing; a session without a
  * transcript still ends. Everything is swallowed; the hook always exits 0.
  */
 export async function handleSessionEndHook(
@@ -943,42 +945,40 @@ export async function handleSessionEndHook(
     if (!payload) return { action: "skipped", reason: "malformed_payload" };
 
     const sessionId = payloadString(payload, "session_id");
+    if (!sessionId) return { action: "skipped", reason: "nothing_to_do" };
     const transcriptPath = resolveTranscriptPath(
       payloadString(payload, "transcript_path"),
       sessionId,
       options.claudeProjectDir,
       options.homeDir,
     );
+    // Read before the close, so the attribution does not lean on the close
+    // preserving `conversation_id` when it deactivates the session.
+    const runtimeSession = getRuntimeSession(db, sessionId);
+    const conversationId = runtimeSession?.conversationId ?? null;
     let backfilled = false;
     // After the close, which bounds the backfill window, and before the tail,
-    // which should see what the backfill adds (CV21.DS4.TS2).
+    // which should see what the backfill adds (CV21.DS4.TS2). A session with no
+    // bound conversation closes nothing and backfills nothing (CR151).
     const backfill = () => {
-      backfilled = transcriptPath !== null && existsSync(transcriptPath);
-      if (backfilled && transcriptPath !== null)
-        backfillAssistantMessages(db, transcriptPath, deps);
+      if (conversationId === null || transcriptPath === null || !existsSync(transcriptPath)) return;
+      backfilled = true;
+      backfillAssistantMessages(db, transcriptPath, conversationId, deps);
     };
 
-    if (sessionId) {
-      // The label US8 stamps on every prompt; the hook's own detection only when
-      // the row carries none; today's behavior when neither names a runtime.
-      const label = getRuntimeSession(db, sessionId)?.interface || options.interface || null;
-      const finalize = sessionEndRunsLlmTail(label);
-      const closed = await endSession(
-        db,
-        sessionId,
-        { extract: finalize, finalize, beforeTail: backfill },
-        deps,
-        hooks,
-      );
-      // A session with no bound conversation closes nothing; the backfill still runs.
-      if (!closed) backfill();
-    } else {
-      backfill();
-    }
+    // The label US8 stamps on every prompt; the hook's own detection only when
+    // the row carries none; today's behavior when neither names a runtime.
+    const label = runtimeSession?.interface || options.interface || null;
+    const finalize = sessionEndRunsLlmTail(label);
+    await endSession(
+      db,
+      sessionId,
+      { extract: finalize, finalize, beforeTail: backfill },
+      deps,
+      hooks,
+    );
 
-    if (sessionId) return { action: "ended", sessionId, transcriptPath, backfilled };
-    if (backfilled && transcriptPath !== null) return { action: "backfilled", transcriptPath };
-    return { action: "skipped", reason: "nothing_to_do" };
+    return { action: "ended", sessionId, transcriptPath, backfilled };
   } catch (error) {
     return { action: "failed", error: error instanceof Error ? error.message : String(error) };
   }

package/ts/src/conversation/transcriptBackfill.ts

@@ -1,23 +1,33 @@
-// Assistant-turn backfill from a Claude transcript (CV22.DS7.US10 slice E).
+// Assistant-turn backfill from a Claude transcript (CV22.DS7.US10 slice E,
+// rescoped by CR151).
 //
-// Ports `backfill_assistant_messages` from
+// Started as a port of `backfill_assistant_messages` from
 // `src/memory/cli/conversation_logger.py` together with the two helpers it
 // borrows from `src/memory/cli/transcript_export.py` (`parse_jsonl`,
-// `_assistant_text`). `hook_session_end` calls it after ending the session --
-// and, when the payload carries no session id at all, INSTEAD of ending one:
-// that session-less route is the path US5's hook port deliberately left out.
+// `_assistant_text`). `hook_session_end` calls it after ending the session.
 //
-// This is not an import: nothing is created or bound. It appends assistant
-// turns to conversations that overlap the transcript's time window and logged
-// no assistant message of their own, stamping each with `now` (Python's
-// `Message` default), not with the transcript timestamp. Python commits every
-// message as it goes and swallows nothing here; a malformed entry reached
-// mid-walk raises with the earlier appends already committed. The port keeps
-// that sequence so partial state matches, and leaves swallowing to the hook.
+// It now DIVERGES from that Python on purpose (CR151). Python chose the
+// conversations to fill by time window alone, so a session's replies were
+// copied into every open, reply-less conversation overlapping its transcript
+// -- a session killed mid-first-turn, or a concurrent one on another runtime --
+// and stamped them with `now`. Do not restore either behavior:
+//
+//   * the caller names the ONE conversation the transcript belongs to (the
+//     ending session's bound conversation); nothing else is touched, and a
+//     transcript no session owns fills nothing;
+//   * an inserted reply carries the transcript's own timestamp, normalized to
+//     the logger's microsecond ISO form, so the reply sorts between the prompts
+//     around it for every reader that orders by `created_at`.
+//
+// This is not an import: nothing is created or bound. A conversation that
+// already logged an assistant turn of its own (the Stop hook's path) is left
+// alone. Appends commit as they go; a malformed entry reached mid-walk raises
+// with the earlier appends already committed, and the hook swallows it.
 
 import { readFileSync } from "node:fs";
 import type { LoggerDeps } from "#conversation/logger.ts";
 import type { WritableDatabase } from "#db/database.ts";
+import { toMicrosecondIso } from "#util/pyGenerators.ts";
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -76,70 +86,67 @@ export function assistantText(contentBlocks: unknown): string {
   return parts.join("\n\n");
 }
 
-/** Python `str` truthiness on the timestamp: absent, null, or empty is skipped. */
+const UTC_ISO = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d+))?Z$/;
+
+/**
+ * A timestamp in the logger's microsecond ISO-`Z` form, or null when it cannot
+ * be read as an instant. Claude writes milliseconds (`.123Z`), the logger
+ * microseconds (`.123000Z`); compared as strings the two disagree (`.123Z`
+ * sorts after `.123456Z`), so every bound and every insert goes through here.
+ * A UTC string is re-padded rather than parsed, keeping microseconds intact.
+ */
+export function normalizeTimestamp(value: string): string | null {
+  const utc = UTC_ISO.exec(value);
+  if (utc) return `${utc[1]}.${(utc[2] ?? "").padEnd(6, "0").slice(0, 6)}Z`;
+  const parsed = new Date(value);
+  return Number.isNaN(parsed.getTime()) ? null : toMicrosecondIso(parsed);
+}
+
+/** An entry's normalized timestamp; absent, empty, non-string, or unreadable is null. */
 function timestampOf(entry: unknown): string | null {
   const value = getOr(entry, "timestamp", "");
-  return typeof value === "string" && value ? value : null;
+  return typeof value === "string" && value ? normalizeTimestamp(value) : null;
 }
 
 /**
- * Python `backfill_assistant_messages`. The transcript window is
- * `[min(timestamp), max(timestamp)]` over entries that carry one; a
- * conversation is in range when `started_at <= window end` and it either
- * ended at or after the window start or is still open. Within an in-range
- * conversation that has no assistant turn, every `assistant` entry whose
- * timestamp falls inside `[started_at, ended_at or window end]` is appended.
+ * Append the transcript's assistant turns to `conversationId` -- the one
+ * conversation the transcript's session is bound to, and only it (CR151).
+ * Skipped when that conversation does not exist or already logged an
+ * assistant turn. An `assistant` entry lands when its timestamp falls inside
+ * the conversation's own `[started_at, ended_at]` (open-ended while the
+ * conversation is open), and it lands stamped with that timestamp.
  */
 export function backfillAssistantMessages(
   db: WritableDatabase,
   transcriptPath: string,
-  deps: LoggerDeps,
+  conversationId: string,
+  deps: Pick<LoggerDeps, "newId">,
 ): void {
-  const entries = parseJsonl(transcriptPath);
-  if (entries.length === 0) return;
+  const conversation = db
+    .prepare("SELECT started_at, ended_at FROM conversations WHERE id = ?")
+    .get(conversationId) as { started_at: string; ended_at: string | null } | undefined;
+  if (!conversation) return;
+  const hasAssistant = db
+    .prepare("SELECT 1 FROM messages WHERE conversation_id = ? AND role = 'assistant' LIMIT 1")
+    .get(conversationId);
+  if (hasAssistant) return;
 
-  const timestamps = entries.map(timestampOf).filter((value): value is string => value !== null);
-  if (timestamps.length === 0) return;
-  // Python's min()/max() on str compare by code point; ISO timestamps are
-  // ASCII, so plain comparison is the same order.
-  let startTime = timestamps[0] as string;
-  let endTime = timestamps[0] as string;
-  for (const value of timestamps) {
-    if (value < startTime) startTime = value;
-    if (value > endTime) endTime = value;
-  }
-
-  const conversations = db
-    .prepare(
-      `SELECT id, started_at, ended_at FROM conversations
-        WHERE started_at <= ? AND (ended_at >= ? OR ended_at IS NULL)`,
-    )
-    .all(endTime, startTime) as { id: string; started_at: string; ended_at: string | null }[];
+  const start = normalizeTimestamp(conversation.started_at) ?? conversation.started_at;
+  const end =
+    conversation.ended_at === null
+      ? null
+      : (normalizeTimestamp(conversation.ended_at) ?? conversation.ended_at);
 
-  const hasAssistant = db.prepare(
-    "SELECT 1 FROM messages WHERE conversation_id = ? AND role = 'assistant' LIMIT 1",
-  );
   const insert = db.prepare(
     `INSERT INTO messages (id, conversation_id, role, content, created_at, token_count, metadata)
      VALUES (?, ?, 'assistant', ?, ?, NULL, NULL)`,
   );
-
-  for (const conversation of conversations) {
-    if (hasAssistant.get(conversation.id)) continue;
-    const conversationStart = conversation.started_at;
-    const conversationEnd = conversation.ended_at ?? endTime;
-
-    for (const entry of entries) {
-      const timestamp = timestampOf(entry);
-      if (!timestamp || !(conversationStart <= timestamp && timestamp <= conversationEnd)) continue;
-      if (getFrom(entry, "type") !== "assistant") continue;
-      const message = getOr(entry, "message", {});
-      const text = assistantText(getOr(message, "content", []));
-      if (text) {
-        // Python: Message(...) draws its id before its created_at.
-        const id = deps.newId();
-        insert.run(id, conversation.id, text, deps.nowIso());
-      }
-    }
+  for (const entry of parseJsonl(transcriptPath)) {
+    const timestamp = timestampOf(entry);
+    if (!timestamp || timestamp < start || (end !== null && timestamp > end)) continue;
+    if (getFrom(entry, "type") !== "assistant") continue;
+    const message = getOr(entry, "message", {});
+    const text = assistantText(getOr(message, "content", []));
+    if (text) insert.run(deps.newId(), conversationId, text, timestamp);
   }
 }